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The remote activation of webcams raises serious privacy concerns that existing 
laws do not adequately address. Webcams have transformed entertainment, medi- 
cine, home security, and many other fields. But they have also been used to spy on 
people in shocking ways. Currently, webcams can be remotely activated by govern- 
ments, businesses, or hobbyist hackers known as "ratters," each with a distinct set 
of goals, but all of whom commit egregious invasions of privacy through remote 
activation. Hundreds of thousands of people have been the targets of surreptitious 
remote webcam activation, yet there has been no meaningful legislative response to 
the problem. Strong legal prohibitions are needed to prevent invasions of privacy 
by remote webcam activation. 

The Constitution guarantees privacy and freedom against unreasonable search- 
es and seizures by the government. These guarantees should preclude the govern- 
ment from remotely activating webcams, given that webcams are frequently located 
in the home, where privacy rights are at their strongest. Yet because the existing 
laws on government electronic surveillance allow secret proceedings and provide 
few opportunities for public oversight, there is noway of knowing how many times 
remote webcam activation has been approved by a judge, or been used without any 
judicial authorization. The FBI has the technological ability to activate a webcam 
without triggering the light meant to notify the user; yet we have no information on 
how many times the FBI has done so. Given the grave constitutional infirmities of 
remote webcam activation and the presence of less invasive alternatives, laws are 
needed to prevent the government from remotely activating webcams. 

Businesses have engaged in shocking abuses of remote webcam activation tech- 
nology. Rent-to-own stores have installed remote webcam activation capabilities on 
rental computers and used it to spy on their customers. Other companies sell remote 
access software that they activate when a computer is reported stolen, attempting 
to gather information on the purported thief to hand to the police. Both of these 
practices have led to egregious privacy violations of innocent people. Yet because 
of a minimum damages requirement in the federal Computer Fraud and Abuse Act 
and outdated language in the Electronic Communications Privacy Act, victims of 
webcam spying have little recourse under federal law. Shockingly, people who have 



their webcams surreptitiously activated and were spied on have been held to have 
no recourse under the federal unauthorized access and wiretap laws. 

Taking advantage of cheap and user-friendly remote access software available 
in the murkier corners of the internet, individual "ratters" are able to take control of 
victims' computers and remotely activate their webcams. Ratters, often young men, 
activate the webcams of their victims, often young women, and attempt to capture 
photos of them nude or having sex. They can then extort their victims — "slave girls," 
as they are often dubbed in ratter circles — for additional nude photos. They trade or 
even sell copies of the private images to others in their online circles. Ratters have 
victimized thousands of young women, including minors. While there have been 
successful prosecutions of prominent ratters, there is no law specifically addressing 
the problem of remote webcam activation. 

Each of these situations demands action to prevent invasions of privacy through 
remote webcam activation. Given its questionable effectiveness and high level of 
intrusiveness, remotely activating webcams should be clearly prohibited as a law 
enforcement investigative technique, and the 

rules of criminal procedure should not be mod- VVg DGCCI StrOngGT l3WS 
ified to encourage its uses. Private businesses fegulatl'onS tO pfOteCt 

should similarly be banned from employing • i i i 

, . . . ^ ^ ^ our right to privacy as we 

remote webcam activation, as its supposed ^ 

benefits for theft prevention and recovery do HTlOVe forWard ifltO tho 
not justify the flagrant violations of privacy interconnected ase. 
that inevitably occur when the technology is 

activated. Furthermore, federal and state law should be updated to provide a civil 
remedy for victims of surreptitious webcam spying. Finally, law enforcement and 
the judicial system should make greater efforts to prevent surreptitious webcam ac- 
tivation and to investigate and punish anyone who uses a webcam to violate a com- 
puter user's privacy. 
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1. INTRODUCTION 




ebcams have transformed contemporary life. Webcams are used 
for numerous purposes, including participating in video calls with 
friends and family worldwide;' preventing theft and providing 
home security;^ monitoring babies' and family members in nursing 



homes to ensure their well-being;"* providing medical care and advice;^ live stream- 
ing events;*' and enabling website logins with facial recognition. ''Webcams also pro- 
vide entertainment: over lOO hours of video, much of it produced by webcam, are 
uploaded to YouTube each minute,* and webcam feeds featuring cute animals are 
promoted as "ambient entertainment" by television networks like Animal Planet.'' 
The chief minister of the Indian state of Kerala even installed a live-streaming web- 
cam in his office as an anti-corruption measure.'" 

While webcams provide valuable functions for many internet users, they also 
raise serious privacy concerns. Readily available remote administration tools allow 
third parties to gain unauthorized access to users' computers and activate their web- 
cams, often without their knowledge. Governments around the world use powerful 
spyware to gain control over individuals' computers, including the ability to covert- 
ly activate the webcam, and in some cases use it to target dissidents." The Federal 
Bureau of Investigation (FBI) has the ability to remotely activate a webcam without 
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detection'^ and has gone to court to request a warrant to do so.'' 

Remote activation software sold to businesses and school districts by private 
companies has been flagrantly abused. In one prominent case, a school district cap- 
tured tens of thousands of digital pictures of unsuspecting students. Meanwhile, 
individual hackers known as "ratters," using 
software available online for $40 or less, trick 
unsuspecting victims into installing remote ac- 
cess Trojans (RATs'^) that can provide full con- 
trol over the victim's computer, including the 
ability to activate the webcam.'^ Reflecting the 
well-documented problem of misogyny on the 
internet,''' ratters discuss their conquests on web discussion boards on sites such as 
hackforums.net, where they dub their victims "slaves" or "slave girls."'* Sometimes 
they hold "slave auctions" where they trade access to victims' computers.'' 

The tools of remote access have long been used for legitimate purposes, includ- 
ing by IT departments for remote configuration, monitoring, and maintenance.^" 
People regularly use these tools to access software and files on their home comput- 
ers when they are away from home.^' Organizations install remote administration 
software on computers distributed to students or employees to assist in their main- 
tenance or to facilitate recovery in case of theft." Rent-to-own businesses have also 
used remote administration software to remotely disable rented computers in the 
event of nonpayment.^' 

Some people unwittingly give ratters access to their webcams by connecting to 
the internet from their home computer, home security system, or devices such as 
baby monitors by failing to configure these tools correctly. At a security conference, 
researchers revealed that they were able to compromise the computers of thou- 
sands of users of remote access tools who neglected to set up password protection. 

Technology allowing the remote activation of webcams raises important law 
and policy issues. Remote activation by government entities, private companies, 
and malicious individuals each raise unique concerns. These concerns include in- 
sufficient disclosure and a lack of opportunity for public oversight in the case of 
government use; incentives for private companies to perform intrusive surveillance 
in place of the police; and existing laws' failure to adequately protect victims of sur- 
reptitious remote activation. 



Webcams have transformed 
entertainment, medicine, home 
security, and many other fields. 
But they have also been used to 
spy on people in shocking ways. 
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2. WHO'S WATCHING YOU? 




lassified documents released to the press revealed that the United States 
government, along with its "Five Eyes" partners, engages in extensive sur- 
veillance of telecommunications networks worldwide. full scope of 
such surveillance has never been disclosed. However, the programs that 



have been revealed are breathtaking in scope. Since May 2006, in its bulk telephony 
metadata collection program, the U.S. government has collected metadata on "sub- 
stantially every telephone call in the United States."^^ In another surveillance pro- 
gram, codenamed "Optic Nerve," the U.K.'s Government Communications Head- 
quarters (GCHQ), with the NSA's assistance, captured and stored webcam images 
from more than 1.8 million Yahoo user accounts worldwide, "including substantial 
quantities of sexually explicit communications."^'' In addition to intercepting com- 
munications, many governments worldwide have the technology to remotely acti- 
vate webcams. 

The scope of government webcam surveillance in the United States is impossi- 
ble to gauge. In the Foreign Intelligence Surveillance Court, which generally han- 
dles requests for electronic surveillance involving foreign intelligence targets (and 
U.S. citizens who associate with them), proceedings are held in secret and orders are 
issued in secret.^" Furthermore, surveillance orders under the Electronic Commu- 
nication Privacy Act (ECPA) governing domestic electronic surveillance are "kept 
under wraps in three ways: sealing of court records, delayed notice to the target, 
and nondisclosure ("gag") orders directed to service providers and their agents."^' 
Targets who are not subsequently charged with a crime will often never learn of the 
surveillance.^" 

Remote webcam activation has also been used by government in the public school 
setting. Between 2008 and 2010, Information Services (IS) personnel at the Lower 
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Merion School District (LMSD) outside Philadelphia used remote access software, 
intended only to be used in cases of theft, to collect a total of 27,428 screenshots 
and 30,564 webcam photos from student-issued laptops.^' "This is awesome. It's like 
a little LMSD soap opera," an IS technician wrote in an email. "I know, I love it!" 
the district's IS Coordinator responded.^' The surveillance came to light when Blake 
Robbins, a 15-year-old student, was confronted by an assistant principal with a web- 
cam photo of him holding what she believed were illegal pills. student said 

he was holding Mike and Ike's candy.^' After 
Blackshades, a RAT, has been Blake and his parents sued the school district, 
used in more than 100 countries it emerged that school personnel had captured 
to infect more than half a million over 400 screenshots and webcam photos via 
computers worldwide. Blake's laptop.^* Jalil Hasan, another student, 

found that school personnel had captured over 
1,000 images — 543 screenshots and 469 webcam photos — gathered over the course 
of two months via his laptop. The district also collected 3,805 photos and 3,451 
screenshots from 12 laptops issued to teachers.^^ The district's gathering of these 
images continued until the day the Robbins family sued the district.^' After the story 
broke, the FBI investigated, but it declined to prosecute any school officials, saying 
existing laws did not cover this situation.^" 

Private businesses also use remote access tools that allow for webcam activation. 
Such tools are intended to help locate stolen computers or to disable computers if 
the would-be purchasers fall behind in their payments. PC Rental Agent, a remote 
access tool providing remote webcam activation capability that was developed for 
and marketed to the rent-to-own industry, was licensed by more than 1,600 Aaron's, 
Inc., franchise stores nationwide and installed on over 400,000 computers rented to 
consumers. 4' 

In addition, thousands of individual "ratters" use RATs to gain control over others' 
computers to allow remote webcam activation.^^ Online discussion boards such as 
Hack Forums frequently discuss methods of avoiding detection while surreptitiously 
activating webcams, for instance by targeting computers whose webcams lack an in- 
dicator light that could alert the user to the webcam being activated. A single, ded- 
icated ratter can harm a large number of victims, sometimes threatening to leak the 
surreptitious photos unless the victims send them better nude photos as ransom. 
Luis Mijangos, a prolific "sextortionist," single-handedly infected 129 computers, 
netting a total of 230 victims, including 44 juveniles. Jared James Abrahams, who 
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gained infamy for victimizing Miss Teen USA 2013 Cassidy Wolf by taking photos 
through her webcam, targeted over 150 victims during his ratting career/' Accord- 
ing to the FBI, Blackshades, Abrahams' RAT of choice, has been "sold and distrib- 
uted to thousands of people in more than 100 countries and has been used to infect 
more than half a million computers worldwide." 4* 
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3. WHAT TECHNOLOGIES ENABLE 
DIGITAL PEEPHOLES? 

A range of technologies exist to allow governments or individuals to take 
over a target's webcam. Surveillance software firm Gamma International 
sells FinFisher, a powerful hacking software suite, to governments world- 
wide.^^ Marketed as a law-enforcement tool, FinFisher can bypass popu- 
lar antivirus products, harvest data from the hard drive, capture webcam footage, 
log keystrokes, and record emails, chats, and Skype calls, all of which it sends to 
a central command-and-control server. The Milan-based company Hacking Team 
offers similar software.^^ Gamma and Hacking Team also sell governments devices 
known as "network injection appliances," which can be installed at an internet ser- 
vice provider (ISP) and used to insert malicious commands into any unencrypted 
web traffic — a tactic security expert Morgan Marquis-Boire called "hacking on easy 
mode."5° Citizen Lab and others have criticized Gamma and Hacking Team for sell- 
ing these tools commercially, including to repressive regimes such as the govern- 
ment of Bahrain, which has tortured political dissidents. In March 2013, Citizen 
Lab found FinFisher command-and-control servers in 25 countries, including the 
United States.^^ 

Even without such sophisticated tools, a person's webcam can be accessed re- 
motely. Activating an ordinary computer user's webcam remotely does not require 
great technical ability. Ratters typically gain unauthorized access to victims' com- 
puters by tricking them into opening a seemingly innocuous file that covertly in- 
stalls a RAT on the victim's computer." The file can be delivered as an email attach- 
ment or a popular song or video on a peer-to-peer file sharing network such as Bit- 
Torrent. ^4 After the RAT is installed, it "phones home" to the ratter's computer and 
grants the ratter control." 
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Tricking a computer user into unwittingly installing a RAT is easy to accomplish 
in practice, even for relatively unskilled users. As journalist Nate Anderson noted, 
"Calling most of these guys 'hackers' does a real disservice to hackers everywhere; 
only minimal technical skill is now required to deploy a RAT and acquire slaves."'*' 
Sometimes, activating a webcam remotely requires no "hacking" at all: using only 
standard instant messaging software, which he configured to automatically accept 

incoming video calls, and aiming his webcam before 
Sometimes, activating a leaving the room, Rutgers student Dharun Ravi was 
webcam remotely requires able to activate his own webcam remotely and spy on 
no "hacking" at all. Tyler Clementi during Clementi's romantic encounter 

with a same-sex partner." 
While many webcams come with a connected light that turns on when the web- 
cam is active, not all do, and reports have shown that it is technically possible to ac- 
tivate many webcams without triggering the indicator light. Online ratter discus- 
sion forums contain threads discussing laptop models with no indicator light, and 
possible methods of activating a webcam without triggering the light, in order to 
avoid alerting the victim to suspicious activity^' According to a former FBI official, 
"the FBI has been able to covertly activate a computer's camera — without triggering 
the light that lets users know it is recording — for several years."^° Johns Hopkins 
University researchers demonstrated that it was possible to reprogram a MacBook 
microcontroller to allow the webcam and indicator light to operate independently 
of one another, even though it was designed specifically to prevent this.''' 
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Ratters, people who use remote access Trojans (RATs) to take control of individual computers andwebcams from 
afar,' have a lively marketplace and advice headquarters at message boards like hackforums.net. There, ratters — 
stereotypically and likely not inaccurately young men — buy and sell "slaves," people whose computers andwebcams 
have been commandeered for the men's vicarious enjoyment. Ratters also trade tips about "slaves" and the best ways 
to spread RAT software. 

While virtually all computers are vulnerable in some way or other to top attackers, ratters, many of whom are 
novices, often rely on one of a few tricks to convince users to infect themselves. There are some common ways, and 
luckily, they are often easily avoidable. 



FAKE MEDIA 

Torrents are a staple of the internet, particularly for those seeking 
to download media, research, and software. Torrents are small files that 
help users locate and download content from many users at once us- 
ing BitTorrent, a protocol designed to enable peer-to-peer sharing and 
downloading. A report by analytics company Musicmetric, for example, 
found that in the first six months of 2012 there were 405 million music 
releases downloaded around the world with the help of torrent files and 
BitTorrent.^ Ratters take advantage of the proliferation of torrent search 
engines by disguising RATs as popular songs and uploading them to the 
internet for torrent sites. 

Ratters search the charts of popular torrented music and upload their 
RATs named after these songs to torrent sites. Ratters pay attention to 
ways of gaming the system, including evading torrent sites' internal con- 
trols by not uploading too many files soon after registering, using multi- 
ple accounts to provide fake positive feedback for a potential download 
(that is actually infected with software to allow the ratter to turn on your 
camera), or uploading legitimate files first to boost reputation. Ratters 
may upload a legitimate version of a song along with a RAT with a name 
like "PASSWORD TO UNLOCK" or "ESSENTIAL: READ ME FIRST." A 
user who clicks the disguised RAT .exe may end up with access to the orig- 
inal file but also can be infected at the same time. It's devious, but luckily 
it's easy to spot. A rule of thumb — if a torrent download requires you to 
click a link or run a separate file in order to access whatever you were af- 
ter, it's better to steer clear. 



"OMG I CAN'T BELIEVE THAT PIC OF U!!!" 
Facebook, Twitter, Chatroom, andAdSpamming 

If you're active on any social networks or chatrooms, chances are 
you've come across a message and link reading something like, "OMG I 
can't believe this picture of u!" These spam messages, which, sites like 
Twitter have fought by limiting the types of links that can be sent via 
the service's Direct Message function, are one way that ratters recom- 
mend spreading their wares. Sometimes, the spam messages will come 
from people you actually know whose computers have been infected and 
turned into zombie transmission devices. Alternately, websites and ads 
designed to look like legitimate products such as the Firefox browser or 
anti-spyware software may also carry RATs. As librarian and privacy ad- 
vocate Alison Macrina Tweeted, a Google or Bing search for Firefox actu- 
ally returned multiple fake Firefox downloads ahead of the actual Firefox 
website.' (No such result appeared in the privacy-friendly DuckDuckGo 
search engine). 

Some lessons are to inspect URLs to make sure they link to the legit- 
imate version of software. You can submit files or links to malware ana- 
lyzer Anubis" or do a web search for the names of unfamiliar programs to 
check for reports that they are infected. And finally, never click (at least 
not without responding tothesender for more information) an out of the 
blue message from a friend on a social network promising a link to a "Cra- 
zy Pic" or something like it. 




'SPEAR PHISHING 

While uploading popular songs with associated malware to torrent 
sites is a common technique to obtain "slaves," there are also tutorials for 
infecting a specific person, perhaps someone a ratter knows in real life. 
Without the randomness of posting a torrent and RAT to a website, the 
creepier process of targeted infection using information from someone's 
life — "spear phishing" — is more elaborate but also in many ways more 
dangerous. In both these cases, however, a ratter needs to trick someone 
in to clicking a link to install the RAT server on their computer. 

One example discussed on hackforums.net outlines a hypothetical 
attack on a college student. In this attack, which the poster's notes can be 
modified to suit different factual situations, a ratter will reach out to a new 
student pretending to be a student organization offering free textbooks. 
The email seems legitimate enough, there may be a flimsy website set up 
for the fake student group, and the files that eventually get sent are actual 
textbooks, pirated by the ratter for the purposes of the attack. When there 
is enough trust between the parties, the fake student organization sends 
the textbooks along with Readme.txt that tells the student to run a fake 
"PASSWORD GENERATOR" .exe file, included along with the password 
protected textbooks. When the victim runs the password generator, they 
are actually running the RAT, but to prevent any concern, the password 
generator also provides a legitimate password for the textbook pdfs. 

This trade is a bad one for the victim, as their computer and privacy are 
compromised. Use common sense — it's pretty unlikely that a student or- 
ganization would randomly email new students and offer free versions of 
copyright-protected textbooks, no matter how convincing the backstory. 



HE MOST DANGEROUS GAME 




While each of these methods develops in its own way, a shared as- 
pect is that they rely on tricking someone into clicking a link to run a file 
that installs and sets up the RAT. Other methods work the same way, with 
added layers of nuance or difference. One way involves hosting a web- 
site featuring a fake video game, where clicking a button in the game will 
load a fake "error" screen and eventually lead to a download screen for a 
software update to "fix" the problem. The same website might contain a 
link to a fake YouTube video advertising the game, where pressing "play" 
triggers an error designed to trick the user into thinking he or she has to 
download some update in order to access (actually the RAT). As a rule, 
reputable websites tend to clearly advertise and contextualize when they 
are going to offer a download link, so a random download accompanying 
a click on a video or game should be distrusted. I 
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4. ASSESSING WEBCAM ACTIVATION 
IN A BROADER LEGAL CONTEXT 

I he proliferation of webcams raises serious privacy concerns. The Fourth 
Amendment of the U.S. Constitution bars unreasonable searches and sei- 
zures, providing restrictions on the remote activation of webcams by gov- 
ernment actors. The constitutional right to privacy provides additional 
protection. Private actors, while generally not bound by constitutional limits, are 
subject to a variety of criminal and civil laws that could potentially be used to re- 
strain their use of remote webcam activation technology. 

The Fourth Amendment to the U.S. Constitution generally requires law enforce- 
ment officers to obtain a warrant to perform a search or seizure, and in obtaining 
the warrant, to state with particularity the place to be searched, and the persons or 
things to be seized.*'^ The U.S. Supreme Court has held that "a Fourth Amendment 
search occurs when the government violates a subjective expectation of privacy that 
society recognizes as reasonable."''^ Furthermore, courts have recognized that "vid- 
eo surveillance can result in extraordinarily serious intrusions into personal pri- 
vacy," prompting heightened scrutiny. ''^ Webcams are often positioned where they 
can reveal intimate details in the home, where "Fourth Amendment interests are at 
their strongest."''^ And because many computers are shared, the remote activation 
of a webcam by law enforcement poses a substantial risk of invading the privacy 
of unintended third parties of no interest to any investigation. The Fourth Amend- 
ment applies only to the government and not to private businesses or individuals, 
unless the business or individual is acting as an agent of the government; if a com- 
pany independently remotely activates a webcam and gives the photos to the police, 
the person photographed has no constitutional protection. 

The federal Computer Fraud and Abuse Act (CFAA), i8 U.S.C. § 1030, makes it a 
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federal crime to intentionally access a computer without authorization.^* The stat- 
ute is broad in scope and has been used to prosecute people for acts ranging from 
accessing workplace computers in violation of corporate policy to collecting and 
disseminating subscriber information made available by AT&T on its public web 
server.'''' However, the statute offers little relief to victims of remote webcam activa- 
tion because it requires showing a minimum $5,000 in monetary damages in order 
to bring a civil claim.'''^ 

The Electronic Communications Privacy Act (ECPA), 18 U.S.C. § 2511 etseq., an 
amendment to the Wiretap Act, prohibits the interception, use, or disclosure of 
electronic communications without the consent of at least one party. The Act does 
not require the permission of the person being photographed, if the other party 
authorizes the snooping. And even in situa- 
tions where the ECPA could potentially have The FTC has held that remote 
been applied to remote webcam activation, WebcaiTI activatl on, without 
courts have been reluctant to find remotely notl'ce tO COnSUITierS, iS an Unfair 
capturing screenshots or activating a web- busineSS practice. 
cam to be a violation. The ECPA is meant 

to cover surreptitious eavesdropping on electronic communications as they occur. 
Courts have held that interception of an electronic communication must occur while 
the communication is "in flight" in order to be covered.''" Applying this metaphor, 
courts have held that webcam photos taken through the use of remote access soft- 
ware cannot be "interceptions" because they are the creations of the person acti- 
vating the webcam, not intercepted communications of the person photographed.''' 

The Federal Trade Commission (FTC) has a broad mandate to prevent unfair 
business practices. Section 5 of the FTC Act, 15 U.S.C. § 45, directs the Commission 
to prevent "unfair methods of competition in or affecting commerce, and unfair or 
deceptive acts or practices in or affecting commerce." In keeping with this directive, 
the FTC has taken enforcement actions against companies for spying on their cus- 
tomers and failing to provide notice of possible webcam surveillance.''^ The FTC has 
indicated that remote webcam activation, without notice to consumers, is an unfair 
business practice because the disclosure of intimate details of private and family 
life can put consumers at risk of physical harm, the collection of bank account and 
other sensitive information can cause financial harm, and both of these can impair 
consumers' peaceful enjoyment of their homes. ''^ 

Finally, remote webcam activation raises state criminal and civil issues, particu- 
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larly invasion of privacy — a claim raised in almost all state-level criminal and civil 
actions involving remote webcam activation.'''* Invasion of privacy goes to the core 
of what is troubling about remote webcam activation, and a claim based on inva- 
sion of privacy will often succeed where, for technical reasons, others fail. In some 
states, such as California, the right to privacy is part of the state Constitution, pro- 
viding the basis for the State Attorney General to prosecute individuals and compa- 
nies that use remote access technologies to turn on webcams without consent. ''^ In 
addition, all fifty states also have criminal laws prohibiting unauthorized computer 
access; some of those laws do not impose a money damages requirement in order to 
bring a civil suit''^ and thus may help victims of webcam snooping. 
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5. LEGAL CONCERNS IN THE REMOTE ACTIVATION 
OFWEBCAMS BY THE GOVERNMENT 

I he government's use of remote webcam activation and other forms of 
electronic surveillance is restricted by the Fourth Amendment to the U.S. 
Constitution, which prohibits unreasonable searches and seizures. The 
Fourth Amendment provides that: 

The right of the people to be secure in their persons, houses, papers, 
and effects, against unreasonable searches and seizures, shall not be 
violated, and no Warrants shall issue, but upon probable cause, sup- 
ported by Oath or affirmation, and particularly describing the place to 
be searched, and the persons or things to be seized.'''' 

This Amendment entails a "particularity requirement," meaning that the police 
can only search a specific place for a specific item or items of contraband, and may 
not simply perform broad, general searches to see what turns up, and a "minimi- 
zation requirement," meaning that the government must take all possible steps to 
avoid searching unrelated third parties. In addition, relevant to the specific issue 
of remote webcam activation, courts have held that video surveillance, in contrast 
to other forms of surveillance, is so uniquely intrusive that it requires particularly 
searching judicial scrutiny.''*' 

The ECPA sets forth the specific requirements for the government to obtain a 
warrant for electronic surveillance.''^ In 2006, Congress expanded the electronic 
surveillance resources at the disposal of the police by passing the Communications 
Assistance for Law Enforcement Act (CALEA), 47 U.S.C. §§ looi-io, which requires 
communications providers to cooperate with law enforcement surveillance efforts 
and to provide officers with access to their systems and facilities in certain circum- 
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stances. Similarly, the CFAA, which broadly outlaws unauthorized computer access, 
contains the exception that it "does not prohibit any lawfully authorized investiga- 
tive, protective, or intelligence activity of a law enforcement agency of the United 
States, a State, or a political subdivision of a State, or of an intelligence agency of 
the United States." These statutes reflect Congress' judgment that electronic surveil- 
lance, under court supervision, can be an important investigative tool. 

However, remote webcam activation, as a uniquely intrusive method even among 
techniques of electronic surveillance, raises serious constitutional questions. The 
webcam can capture the image of anyone using the computer, not only the person 
of interest in the investigation, and thus poses serious risks for infringing on the 
rights of innocent third parties. Moreover, in a situation where the location of the 
computer itself is unknown, surveillance might ensnare the wrong computer en- 
tirely. 

In April 2013, U.S. Magistrate Judge Stephen W. Smith^° denied an application by 
the FBI to install remote access software on an unspecified computer in an unknown 
location, and to perform remote electronic surveillance, including by activating its 
webcam.^' Judge Smith held that he was not authorized to issue such a warrant under 



the territorial limits imposed by Rule 41(b) of 
Remote webcam surveillance the Federal Rules of Criminal Procedure,^^ that 
poses serious risks for infringing the request risked affecting too many unrelated 



quirements imposed on video surveillance because of its unique intrusiveness.^'* 

In the case presented to Judge Smith, unidentified individuals gained unautho- 
rized access to a victim's email account, and used information gathered to access his 
bank account.^^ Internet Protocol (IP) address of the computer accessing the vic- 
tim's account appeared to indicate that the computer was in a foreign country. The 
victim discovered the breach and took steps to secure his email account. Following 
this, an email account with an address nearly identical to the victim's was used to 
attempt a sizable transfer of funds from his account to a foreign bank account. The 
FBI began an investigation. 

The FBI then sought a warrant allowing it to target an unknown computer with 
remote access software by sending it to the email address used by the identity 
thieves.^*' The software would allow the government to search and extract various 



upon the privacy rights of 
innocent third parties. 



third parties to meet the Fourth Amendment's 
specificity requirement,^^ and that the request 
failed to meet the heightened constitutional re- 
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data from the thieves' computer's hard drive, random access memory (RAM), and 
other storage media, to obtain latitude and longitude coordinates for the computer's 
location, to take screenshots, and to activate its webcam in attempt to identify the 
computer's location and users.^'' 

Judge Smith held that he lacked jurisdiction even to issue such a warrant.^^ Un- 
der Federal Rule of Criminal Procedure 41(b): 

At the request of a federal law enforcement officer or an attorney for 
the government: 

(i) a magistrate judge with authority in the district — or if none is rea- 
sonably available, a judge of a state court of record in the district — 
has authority to issue a warrant to search for and seize a person or 
property located within the district[.] 

The government argued that Rule 41(b)(1) gave Judge Smith authority to issue the 
warrant because the data gathered remotely would be examined in the territory over 
which he had authority — the Southern District of Texas.**' Because its agents would 
not need to leave the district in order to obtain and view the data gathered, the gov- 
ernment argued, the data would effectively become "property located within the 
district" under Rule 4i(b)(i).''° 

Judge Smith rejected this argument, holding that he was precluded from issuing 
a warrant to perform a search in an unknown territory. According to Judge Smith, 
the government's logic "would permit FBI agents to roam the world in search of 
a container of contraband, so long as the container is not opened until the agents 
haul it off to the issuing district.'"'' Judge Smith noted that the request was actually 
two-fold, consisting first of a search for the target computer itself, and then a search 
within the target computer for digital information stored on, or generated by, the 
target computer.''^ Judge Smith explained that the proposed search for information 
on the target computer "takes place, not in the airy nothing of cyberspace, but in 
physical space with a local habitation and a name."'' Hence, allowing these searches 
to occur anywhere so long as the data and images gathered were examined in the 
issuing district would nullify the limits set by Rule 41(b)(1).'''* 

Additionally, Judge Smith found that even if he had authority to issue the war- 
rant, it would fail under the Fourth Amendment's requirements of particularity and 
minimization. The Fourth Amendment requires that a search warrant "particular- 
ly [describe] the place to be searched, and the persons or things to be seized."'^ As- 
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suming that the computer would be targeted with spyware sent via the counterfeit 
email address — since the warrant application did not disclose the targeting meth- 
od — Judge Smith reasoned that the malware could infect the computers of other 
individuals who happened to share the target 

email address.9^ The malware could also infect EveD if the Govemment COUld 
uninvolved computers, such as a public com- meet the minimization and 
puter at which the intended target happened to particularity requirements Of the 
check his or her email. Furthermore, the search Fourth Amendment, Webcam 
could be routed through one or more unrelated SUrveillance WOUld likely not paSS 
computers if the target computer's IP address constitutional mUStor. 
were "spoofed." As the court explained: 

What if the Target Computer is located in a public library, an inter- 
net cafe, or a workplace accessible to others? What if the computer 
is used by family or friends uninvolved in the illegal scheme? What 
if the [target] email address is used for legitimate reasons by others 
unconnected to the criminal conspiracy? What if the email address 
is accessed by more than one computer, or by a cell phone and other 
digital devices ?57 

The government' s application offered only the conclusory statement that "the meth- 
od in which the software is added to the target computer is designed to ensure that 
the [persons] committing the illegal activity will be the only individuals subject to 
said technology." The court found this assurance insufficient to satisfy the particu- 
larity requirement.59 

Furthermore, according to Judge Smith, even if the government had met the 
minimization and particularity requirements, its request for webcam surveillance 
would still likely fail to pass constitutional muster. Courts have held that the Fourth 
Amendment imposes a special, heightened standard of scrutiny on requests to per- 
form video surveillance. In United States v. Cuevas-Sanchez,^°° the U.S. Court of Appeals 
for the Fifth Circuit described video surveillance as "a potentially indiscriminate 
and most intrusive method of surveillance," and set forth heightened standards for 
a warrant authorizing video surveillance:'"' 

[A] search warrant authorizing video surveillance must demonstrate 
not only probable cause to believe that evidence of a crime will be cap- 
tured, but also should include: (i) a factual statement that alternative 
investigative methods have been tried and failed or reasonably ap- 
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pear to be unlikely to succeed if tried or would be too dangerous; (2) a 
particular description of the type of communication sought to be in- 
tercepted, and a statement of the particular offense to which it relates; 

(3) a statement of the duration of the order, which shall not be longer 
than is necessary to achieve the objective of the authorization nor, in 
any event, longer than 30 days, (though extensions are possible); and 

(4) a statement of the steps to be taken to assure that the surveillance 
will be minimized to effectuate only the purposes for which the order 
is issued.'"^ 

Judge Smith held that the government's request to perform webcam surveillance 
failed to meet these heightened standards because it failed to adequately consider 
less invasive alternatives or minimize its scope. Instead, the application stated, in 
language reciting the legal standard, that alternative methods "reasonably appear to 
be unlikely to succeed if tried or would be too dangerous." However, in a separate 
warrant application the government had sworn that internet service provider (ISP) 
records would likely reveal the suspects' identities and locations. In light of this. 
Judge Smith rejected the government's assertion that alternative methods to web- 
cam surveillance would likely be unsuccessful if tried or too dangerous.'"'' Further, 
the government asserted in its application that the software was designed to cap- 
ture only "the minimal necessary information needed to identify the location of the 
Target Computer and the user," but the warrant application described a wide variety 
of data to be extracted, including "Internet browser history, search terms, e-mail 
contents and contacts, 'chat', instant messaging logs, photographs, correspondence, 
and records of applications run."'°'' Judge Smith found that the volume of informa- 
tion the government intended to collect undermined its assertion that the intended 
surveillance would be minimized. 

In response to Judge Smith's adverse ruling, in September 2013 the U.S. Depart- 
ment of Justice (DOJ) wrote to U.S. Circuit Judge Reena Raggi, Chair of the Advisory 
Committee on the Rules of Criminal Procedure, to propose an amendment to Rule 
41(b) to loosen the territorial requirements for warrants in searches for electronic 
storage media. The DOJ proposed adding a sixth subsection to Rule 41(b): "a mag- 
istrate judge with authority in any district where activities related to a crime may 
have occurred has authority to issue a warrant, to be executed via remote access, for 
electronic storage media or electronically stored information located within or out- 
side that district.""" In May 2014, the Advisory Committee recommended that this 
proposed amendment be submitted for public comment.'" As of yet, the rule has not 
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been amended. 

Even in the event of such a rule change, however, any request by law enforce- 
ment to remotely activate a webcam would suffer from the same constitutional de- 
ficiencies as the warrant application in the Texas case. The particularity problems 
noted by Judge Smith — i.e. , the high likelihood of a remote search ensnaring un- 
related computers and files and uninvolved individuals — appear inherent in any 
government remote activation operation. As the ACLU has noted, "the particularity 
problems likely to be raised by remote access search warrants are entirely predict- 
able.""^ Likewise, there appear to be few situations, if any, in which a request to in- 
stall software for remote webcam surveillance could meaningfully be "minimized 
to effectuate only the purposes for which the order is issued.""^ Furthermore, the 
proposed rule change does not address the enhanced constitutional requirements 
for video surveillance, which Judge Smith held precluded remote webcam activa- 
tion. Remote activation of webcams by government runs afoul of the principles of 
the Fourth Amendment. Even though Judge Smith denied a warrant to the FBI to 
remotely activate a webcam, it is impossible to learn whether other judges in secret 
hearings are authorizing such warrants. Consequently, to ensure that the Fourth 
Amendment principle is followed, it may be necessary to adopt a statue to specifi- 
cally forbid webcam activation by government entities. 
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6. LEGAL CONCERNS IN THE REMOTE ACTIVATION 
OF WEBCAMS BY PRIVATE COMPANIES 



rivate companies have also used tools allowing remote webcam activation, 



in particular for anti-theft purposes. Absolute Software reports that it suc- 



cessfully recovers three out of four laptops reported stolen by purchasers 
of its Lojack remote access tool."^ PC Rental Agent, another such tool, was 
developed in part as a theft recovery tool by a computer programmer and owner 
of several rent-to-own stores. Proponents of the tools claim that they are useful in 
recovering stolen computers by providing the ability to determine who is using the 
computer believed or reported to be stolen. But companies have abused these tools 
once installed, resulting in litigation and FTC enforcement actions. 

Private companies face no constitutional obstacles to remotely activating web- 
cams, since the Constitution applies only to the government. The Computer Fraud 
and Abuse Act (CFAA) is also of little use to most victims of private webcam surveil- 
lance. Under the CFAA, a private plaintiff must be able to show loss during a one- 
year period of at least $5,000 in order to bring a civil suit under the statute,"*' and the 
harms of webcam spying are largely dignitary, emotional, and psychological rather 
than monetary. Potentially more helpful to plaintiffs, the ECPA imposes safeguards 
against electronic surveillance and provides a private right of action for actual or 
statutory damages."'' However, at least one judge who considered the question has 
doubted that remotely taking screenshots or activating a webcam could constitute a 
forbidden "interception" under the ECPA."^ 

State law can provide potential recourse in some instances. Almost all U.S. states 
recognize an actionable right to privacy, either by statute or common law"" Among 
common law privacy claims, the common law tort of intrusion into seclusion is par- 
ticularly pertinent to the issue of webcam spying, in some cases along with public 
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disclosure of private facts. Additionally, California's constitution expressly pro- 
vides a right to privacy under which Californians may bring a civil action.'^" Hence, 
in most U.S. states, people who are spied on by private parties through their web- 
cams could potentially have legal recourse under the state privacy laws.'^' But peo- 
ple may not realize they have these rights and judges may not be willing to enforce 
them in situations involving an investigation into a purported theft. 

The Application of Federal Wiretap Statutes to Corporations 

The rent-to-own industry was an early adopter of remote access tools, including 
webcam activation capabilities. Typically situated in poor, largely-minority neigh- 
borhoods, rent-to-own stores sell goods on installment at total prices often dra- 
matically larger than those at traditional stores. '^^ Consumer advocates have long 
condemned rent-to-own stores for charging higher costs for the same goods than 
more affluent consumers pay at traditional 



stores, depriving their customers of key con- The rent-tO-OWD industry WaS an 
sumer protections, and taking advantage of early adopter Of remote aCCOSS 
people less able to evaluate transactions for tOOlS including WebcaiTI activatl'on 



umented how new surveillance technologies 

have disproportionately targeted people of color and the poor (sometimes with 
these groups used as testing grounds for surveillance tools later introduced into the 
broader population). '^^ In keeping with this trend, rent-to-own stores were at the 
center of one of the first national scandals involving remote webcam activation. 

In December 2010, Christopher Mendoza, a manager at a franchise of Aaron's, 
a rent-to-own chain, visited the home of Brian and Crystal Byrd to confront them 
about being behind on payments for their laptop. '^^ Mendoza confronted Brian 
Byrd with a screenshot and webcam photograph of him taken an hour earlier via 
the computer Byrd was using to play online poker.'^^ Brian asked how Mendoza had 
obtained the images, and Mendoza told him about PC Rental Agent, a remote access 
tool installed on the computer.'^'' Byrd produced a receipt stating that the computer 
was paid in full, and Mendoza left.'^** Later, Crystal Byrd recalled that the computer's 
webcam light had come on intermittently in the preceding weeks, including on one 
instance in which she was using the computer wearing only her underwear.'^'' Later, 
the Byrds learned that their computer was accessed using PC Rental Agent approxi- 



fairness.'^^ Furthermore, scholars 
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mately 347 times over a one-month period in November and December 2010.'^° 

Years earlier, beginning in 2007, Aaron's franchisees began instaUing PC Rental 
Agent on computers prior to rental, without informing customers.'^' PC Rental Agent 
included a "kill switch" that would disable the computer in cases of nonpayment. '^^ 
It also included "Detective Mode," which displayed a fake registration screen to so- 
licit personal information from the computer user, and allowed stores to surrepti- 
tiously collect keystroke logs, screenshots, and webcam photos. While designed to 
provide stores with "gotcha" evidence against customers who reported computers 
stolen but continued to use them, a former manager at an Aaron's franchise testified 
that more often than not, the individuals against whom PC Rental Agent was used 
were not in default.''"* PC Rental Agent captured sensitive information from these 
customers, including names, addresses, phone numbers. Social Security numbers, 
and financial information. '^^ former manager testified that she also saw hun- 
dreds of webcam photos of individuals and that managers would "basically sit back 
there and joke about it."'''' 

The Byrds filed a class action lawsuit against Aaron's, Inc. , Aspen Way Enter- 
prises (the Aaron's franchise from which the Byrds had purchased the computer), 

other franchisees using PC Rental Agent, and 
A rent-to-own store covertly DesignerWare LLC (the company that had 
accessed a customer's computer created PC Rental Agent and licensed it to 
approximately 347 times over the Aspen Way and other franchisees). The Byrds 
course of 30 days asserted claims under the ECPA, Section 2511, 

which prohibits the interception, disclosure, 
and use of electronic communications, and Section 2512, which prohibits the use 
of devices having the primary purpose of intercepting electronic communications. 
The Byrds alleged that the defendants had unlawfully intercepted screenshots, key 
logs, and webcam photos under Section 2511, and that PC Rental Agent was unlawful 
under Section 2512 as a device for intercepting electronic communications.''-' They 
also asserted that the defendants accessed their computer without authorization in 
violation of the CFAA."** 

DesignerWare and Aaron's filed motions to dismiss, arguing that the Byrds 
lacked standing and that they had failed to state a claim on the merits.'''' Specifical- 
ly, they argued that the Byrds had failed to plead facts showing the contemporane- 
ous transmission of an electronic transmission under ECPA Section 2511, that there 
was no private right of action under ECPA Section 2512, and that they had failed 
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to plead facts showing the minimum of $5,000 in "damage" or "loss" to support a 
claim under the CFAA.'4° Aaron's further argued that the Byrds' pleadings contained 
allegations against only the franchisee defendants, and that there was no secondary 
liability under the statutes that could implicate Aaron's. '4' 

Section 2511 of the ECPA criminalizes, with certain exceptions, the actions of 
anyone who: 

(a) intentionally intercepts, endeavors to intercept, or procures any 
other person to intercept or endeavor to intercept, any wire, oral, or 
electronic communication; . . . 

(c) intentionally discloses, or endeavors to disclose, to any other 
person the contents of any wire, oral, or electronic communication, 
knowing or having reason to know that the information was obtained 
through the interception of a wire, oral, or electronic communication 
in violation of this subsection; [or] 

(d) intentionally uses, or endeavors to use, the contents of any wire, 
oral, or electronic communication, knowing or having reason to know 
that the information was obtained through the interception of a wire, 
oral, or electronic communication in violation of this subsection 

An "electronic communication" is defined generally in 18 U.S.C. § 2510(12) as: 

any transfer of signs, signals, writing, images, sounds, data, or intel- 
ligence of any nature transmitted in whole or in part by a wire, radio, 
electromagnetic, photoelectronic or photooptical system that affects 
interstate or foreign commerce 

"Intercept," under 18 U.S.C. § 2510(4), means "the aural or other acquisition of the 
contents of any wire, electronic, or oral communication through the use of any elec- 
tronic, mechanical, or other device." Section 2520 provides a private right of action 
to anyone whose electronic communications are intercepted in violation of Section 
2511. 

A key disagreement between the parties concerned whether PC Rental Agent 
"intercepted" electronic communications within the meaning of Section 2511. Aar- 
on's argued that various U.S. Circuits, including the Third Circuit, have held that an 
electronic communication must be intercepted contemporaneously with its trans- 
mission in order to give rise to liability under Section 25ii.'42 Screenshots and key- 
strokes, Aaron's argued, are not captured during transmission because they capture 
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a static image on the Byrds' computer screen and a set of letters previously typed. 
Similarly, Aaron's argued that the webcam photo of Brian Byrd was created by De- 
tective Mode itself and therefore not a communication of Brian Byrd's that was cap- 
tured during transmission. '^^ In response to these arguments, the Byrds argued that 
Brian Byrd was transmitting data back and forth with a poker website, as reflected 
on the computer screen, at the time the screenshot and webcam photo were taken.'44 
The Byrds' response brief offered screenshots captured by PC Rental Agent, along 
with timestamped emails reflecting the receipt of emails by Aspen Way (the Aaron's 
franchise) reporting the keystrokes shown as evidence of contemporaneous inter- 
ception. 

Early in the proceedings, the presiding magistrate judge found that the capture 
and transmission by PC Rental Agent of a screenshot and keystrokes entered by 
Brian Byrd constituted "interceptions" under Section 2511 because they occurred 
contemporaneously with their transmission over the internet.''**' The magistrate 
judge further found that the screenshot and keystrokes constituted "electronic com- 
munications" under 18 U.S.C. § 2510(12). However, the magistrate judge found that 
the webcam photo did not constitute an "interception" within the meaning of Sec- 
tion 2511 because Brian Byrd, despite being pictured, did not take or transmit the 
photo.'47 

Later, reviewing the magistrate's report, the district judge adopted the finding 
that the webcam photo was not an "interception" under Section 2511; he also ex- 
pressed skepticism as to whether the captured keystrokes and screenshots consti- 
tuted "interceptions," but allowed those issues to proceed to discovery for factual de- 
velopment. '4** In March 2014, the court dismissed all franchisee defendants except 
Aspen Way on standing grounds, and denied the Byrds' motion for class certifica- 
tion. '^9 The parties remaining in the case continue to dispute the issue of what con- 
stitutes "interception" under the ECPA, and the denial of class certification is cur- 
rently on appeal. '5° Separately, in June 2014, two lawyers who were rental computer 
customers of Aaron's filed a new lawsuit against Aaron's over PC Rental Agent, as- 
serting Georgia law invasion of privacy and computer trespass claims. '5' 

The Byrd case highlights a significant shortcoming in the law: in the court's view, 
the ECPA prevented Aspen Way from intercepting the Byrds' electronic communi- 
cations, but not from taking over their computer itself and invading their privacy 
in their home. Aspen Way would have faced ECPA liability for intercepting a photo 
of Crystal Byrd in her underwear, but would not face liability under the statute for 
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hijacking her computer and taking one with her webcam. In part, this is because of 
the weakness of the "flight" metaphor: what does it mean for an electronic commu- 
nication to be "in flight?" Does the computer's relaying data from the internet to the 
laptop screen count? What about keystrokes that, when entered, are immediately 
recorded and sent to a third party server by a program on the computer? The "flight" 
metaphor in the ECPA context is a red herring that leads to absurd results; courts 
should take a step back and consider the bigger picture, rather than getting hung up 
on flawed metaphors for "interception" when considering ECPA claims. 

The Application of Federal Trade Commission Actions to Corporations 

Private companies seeking to perform webcam surveillance are also subject to 
the FTC's authority to enforce the federal prohibition on unfair and deceptive busi- 
ness acts and practices. The FTC Act, 15 U.S.C. § 45(a)(1) prohibits "unfair methods of 
competition in or affecting commerce, and unfair or deceptive acts or practices in or 
affecting commerce," and gives the FTC the authority to investigate infractions and 
commence enforcement actions against companies who engage in unfair or decep- 
tive business practices. '^^ These include acts or practices which are "likely to cause 
substantial injury to consumers which is not reasonably avoidable by consumers 
themselves and not outweighed by countervailing benefits to consumers or to com- 
petition."'" In the software context, this includes cases in which a product fails to 
work as advertised or to follow its own privacy policy. It can also encompass situ- 
ations in which there is no misrepresentation to consumers by the developer, but 
where the software acts in ways so negligent or contrary to consumer interests as to 
be inherently unfair, such as by failing to encrypt a customer's financial or medical 
information while transmitting it over the internet.'54 

After the PC Rental Agent scandal came to light, the FTC launched investiga- 
tions of Aaron's, various Aaron's franchisees (including Aspen Way Enterprises, 
where Brian and Crystal Byrd purchased their laptop), and DesignerWare and its 
principals, all resulting in formal complaints.'" The complaints charged that the use 
of PC Rental Agent's information-gathering, monitoring, and surveillance capabil- 
ities without prior disclosure to customers constituted unfair business practices. '5'' 

The FTC complaints centered on the charge that it was an unfair and deceptive 
business practice to use PC Rental Agent to gather information from customers 
without their knowledge.'" Specifically, in its complaint against Aspen Way, the 
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FTC alleged: 

Aspen Way has obtained data via Detective Mode that has revealed 
private, confidential, and personal details about the computer user. 
Keystroke logs have displayed usernames and passwords for access 
to email accounts, social media websites, and financial institutions. 
Screenshots have captured additional confidential details including 
medical records, private emails to doctors, employment applications 
containing Social Security numbers, bank and credit card statements, 
and discussions of defense strategies in a pending lawsuit. Webcam 
pictures have photographed not only the computer's user, but also 
anyone else within view of the camera. In numerous instances. Aspen 
Way has obtained pictures taken secretly inside the computer user's 
home. These have included images of minor children and individuals 
not fully clothed 

Aspen Way's gathering of private and confidential information about 
individuals causes or is likely to cause substantial harm to custom- 
ers. Because of Aspen Way's intrusion, customers are at risk of harm 
from exposure of their personal, financial account access, and medi- 
cal information. Consumers are actually harmed by Aspen Way's un- 
warranted invasion into their homes and lives, and its capture of the 
private details of individual and family life, including, for example, 
images of visitors, minor children, family interactions, and partially 
undressed individuals. Secretly collecting such data can cause con- 
sumers financial and physical injury and impair their peaceful en- 
joyment of their homes. Consumers cannot reasonably avoid these 
injuries because Detective Mode is invisible to them. The harm caused 
by Aspen Way's unauthorized gathering of confidential consumer in- 
formation is not outweighed by countervailing benefits to consumers 
or to competition; indeed, in this context, where rent-to-own stores 
have alternative effective methods of collection, e.g. , using PC Rental 
Agent to remotely disable the computer, there are no legitimate bene- 
fits to respondent or to the public. 

The complaints against DesignerWare and Aaron's contained nearly identical lan- 
guage. '^9 The FTC further alleged that it was unfair and deceptive to use PC Rent- 
al Agent to display a fake registration window to collect the user's name, address, 
email address, and phone number, in order to find, require payment for, or repos- 
sess a computer. The FTC alleged that this was deceptive because consumers' in- 
formation was collected under false pretenses, and unfair because consumers were 
"deprived of the ability to control who has access to their contact information and 
how they are contacted.""'' 

While company-owned Aaron's stores did not use PC Rental Agent, the FTC al- 
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leged that Aaron's had nonetheless engaged in unfair and deceptive business prac- 
tices because it knew that franchisees had Hcensed PC Rental Agent and installed it 
on computers rented to consumers. '^^ Aaron's knew this, it alleged, because senior 
executives had given franchisees permission to access the DesignerWare website for 
purposes of implementing PC Rental Agent, despite an Aaron's IT employee's as- 
sessment of the software as "very intrusive.""'^ Aaron's provided franchisees with 
troubleshooting advice for installing PC Rental Agent, and provided step-by-step 
installation instructions in a company newsletter and on its website.'*''* Aaron's could 
have prevented its franchisees from using PC Rental Agent because its franchise 
agreement allowed it to "terminate a franchisee that breaches any Aaron's policy or 
practice or that violates federal, state, or local laws, regulations, or ordinances." '^'^ 
Indeed, Aaron's policy prohibited unlawful computer use and mandated fair collec- 
tion practices."'^ 

The FTC enforcement actions resulted in settlement orders with each company.'^'' 
The settlement orders prohibit the companies from using any "monitoring technol- 
ogy""'^ to gather information or data from any computer rented to a consumer, and 
prohibit DesignerWare from "licensing, selling, or otherwise providing third par- 
ties with monitoring technology for installation or activation on computers rent- 
ed to customers.""'' The prohibited "monitoring technologies" include remote acti- 
vation of the webcam.'''" The orders further prohibit the gathering of information 
from consumers using any "geophysical location tracking technology"'''' unless "the 
computer user is provided clear and prominent notice at the time the computer is 
rented and immediately prior to each use of the geophysical location tracking tech- 
nology."'''^ However, the orders allow monitoring and geophysical location tracking 
technologies to be used when a computer is reported stolen and a police report has 
been filed stating that the computer was stolen. '''' 

The orders also prohibit the companies from using a fake software registration 
window to gather consumer information.''''* Specifically, the orders prohibit "mak- 
ing, or assisting others to make, any false representation or depiction in any no- 
tice, prompt screen, or other software application appearing on the screen of any 
computer that results in gathering information from or about a consumer, includ- 
ing without limitation location information." '''' The order against Aaron's further 
requires the company to engage in oversight and monitoring of its franchisees to 
prevent their engaging in prohibited practices.''"' 

In sum, the FTC found PC Rental Agent to be unfair and deceptive to consum- 
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ers because it gathered their personal information under false pretenses, surveilled 
them without notice, and sent their data insecurely to Aaron's servers. PC Rental 
Agent's webcam activation tool was designed as a "gotcha" tactic to catch thieves in 
the act without tipping them off; as its creator testified, it depended on the customer 
not having knowledge of its existence. The use of remote webcam activation tools by 
businesses will likely often involve unfair and deceptive acts and practices prohib- 
ited by the FTC Act. 

Police Work by Private Companies 

Investigative collaborations between private companies and law enforcement 
can blur the line between state and private action, with important legal implica- 
tions. Because private companies are not bound by the constitutional rights of indi- 
viduals that limit what the police can do, compa- 



nies can currently take investigations into their When highly invasive tactlCS 
own hands and simply hand the evidence over to like reiTIOte Webcam Spying are 
law enforcement. There is no Fourth Amendment USed, 3 private Company may 



zure is unreasonable provided that the private 

citizen is not acting as an agent of the state.'-''' This arrangement holds clear appeal 
for both the company and law enforcement. Private companies can take investiga- 
tive actions that police are either forbidden entirely from undertaking or cannot 
undertake without time-consuming paperwork and judicial scrutiny. And law en- 
forcement officers have long enjoyed the judicial rule that they are not required to 
"avert their eyes" from evidence third parties present to them so long as there is not 
a preexisting agency relationship.'''*' Thus, surveillance by a private company gath- 
ering evidence for police can substantially expedite an investigation. But in the case 
of potentially invasive techniques such as remote access software, it is questionable 
whether a private company should be able to do what amounts to police work, with- 
out the constitutional constraints that apply to the police. 

Susan Clements-Jeffrey, a substitute teacher at an alternative school in Spring- 
field, Ohio, purchased a laptop from a ninth-grade student who told her that he had 
been given a new one and no longer needed it.'^'' In fact, it was a stolen laptop that 
belonged to the school district where she worked and he was a student."^" The dis- 



protection from a search or seizure performed 
by a private individual even if that search or sei- 



improperly be performing what 
amounts to police work. 
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trict had installed Lojack for Laptops, a remote access software developed by Abso- 
lute Software, Inc. , that gave Absolute investigators the ability to remotely access 
the computer, capture keystrokes, and take screenshots.'^' The district reported to 
Absolute that the laptop was stolen, and Kyle Magnus, a "theft recovery officer" for 
Absolute, used Absolute's remote access tool to gather information from the laptop 
including keystrokes and screenshots.'**^ Some of the screenshots, taken while Cle- 
ments-Jeffrey was using her webcam, displayed her partially undressed and in inti- 
mate positions while chatting with her boyfriend, Carlton Smith. '^'^ Magnus passed 
the information along to local police, who in turn used the explicit screenshots to 
berate and humiliate Clements -Jeffrey while arresting her for possessing the sto- 
len laptop. One of the policemen told Clements -Jeffrey that the pictures were 
"disgusting" and that she was stupid for sending sexually explicit video by webcam, 
and explained how Lojack had allowed them to track the computer and monitor her 
communications. '^'^ 

Clements-Jeffrey and Smith sued the City of Springfield, the police officers. Ab- 
solute Software, and Magnus.'^'' Clements -Jeffrey and Smith sought relief against 
the police officers under 42 U.S.C. § 1983, which provides a private cause of action 
for constitutional violations, claiming that the search of her apartment had violated 
her rights under the Fourth and Fourteenth Amendments.'^'' Clements -Jeffrey and 
Smith also alleged that the police, the City, and Absolute had violated the ECPA and 
the Stored Communications Act (SCA), and that the police and Absolute had inten- 
tionally invaded her privacy under the common law by obtaining the images from 
her computer."*^ The defendants moved for summary judgment on all claims except 
the § 1983 claim relating to the search of Clements -Jeffrey's apartment."*" 

Absolute argued that each of the plaintiffs' claims failed as a matter of law be- 
cause Clements -Jeffrey should have known the laptop was stolen, and Clements-Jef- 
frey and Smith could not reasonably expect their conversations on a stolen laptop 
to remain private.''" The court applied a two-factor test to determine whether Clem- 
ents-Jeffrey and Smith had a legitimate expectation of privacy: "(i) whether the in- 
dividual, by conduct, has exhibited an actual expectation of privacy; that is, whether 
he has shown that he sought to preserve something as private; and (2) whether the 
individual's expectation of privacy is one that society is prepared to recognize as 
reasonable." '5' The court had no trouble finding that Clements-Jeffrey and Smith 
expected their communications to stay private, noting their use of password pro- 
tection and the intimate nature of the communications themselves.''^ However, the 
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reasonableness of the expectation depended on whether she should have known the 
laptop was stolen. The court found that there was a genuine issue of material fact 
as to whether Clements -Jeffrey should have known the laptop was stolen, and this 
precluded summary judgment. ''^ 

Clements-Jeffrey also argued that the police had violated her Fourth Amend- 
ment rights against unreasonable search and seizure by acquiring sexually explicit 
images that were unnecessary to their investigation and using them to humiliate 
her.''4 The court rejected this argument because the photographs were not the prod- 
fuct of a police search, but were provided by Absolute. ''^ The court similarly rejected 
Clements -Jeffrey's argument that the police had acted "in tandem" with Absolute in 
acquiring the photos, finding that there was no evidence that the police instigated, 
encouraged, or participated in the search performed by Absolute.'^'' 

As for the ECPA claims, Clements -Jeffrey and Smith argued that by disclosing 
and using the screenshots of their conversations, the police had violated i8 U.S.C. § 
25ii(i)(c) & (d), which prohibit the disclosure and use of illegally intercepted com- 
munications.''^ The court denied summary judgment to the police on these claims, 
rejecting their arguments that the disclosure and use of the screenshots were law- 
ful.''^ The court further rejected the argument of the police that they had no rea- 
son to doubt the legality of Absolute's conduct, holding that a reasonable jury could 
conclude that the police should have known Absolute's actions were illegal. "'^ The 
court also rejected the argument of the police that a "clean hands" exception previ- 
ously recognized by the Sixth Circuit with respect to the exclusionary rule in crimi- 
nal cases should apply to civil suits. However, the court held that the officers were 
entitled to qualified immunity on the claims because the law in the area was not 
clearly established.^"' 

Clements -Jeffrey and Smith also argued that Absolute violated i8 U.S.C. § 2511(1) 
(a) & (c) by intentionally intercepting their communications and disclosing them to 
the police.^°^ Characterizing Clements-Jeffrey and Smith as "computer trespassers," 
Absolute countered that ECPA liability was precluded by 18 U.S.C. § 25ii(2)(i), which 
provides generally that a person acting under color of law is not liable under the 
ECPA for intercepting the communications of a computer trespasser.^°^ The court 
rejected this argument because Absolute was not acting under color of law.^°4 Abso- 
lute argued further that "the rights of a user of stolen property can never trump the 
rights of the legal owner of the stolen property." The court rejected this argument 
because there was a question of fact about whether Clements-Jeffrey should have 
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known the computer was stolen. 

Clements-Jeffrey and Smith were allowed by the court to proceed against Abso- 
lute but not the police on their common-law invasion of privacy claims.^"* Ohio law 
recognizes a cause of action for "wrongful intrusion into one's private activities in 
such away as to outrage or cause a person of ordinary sensibilities to suffer mental 
suffering, shame or humiliation."^"'' The court held that a reasonable jury could find 
that Absolute's conduct met this standard. However, the court held that the police 
could not be held liable for invading the plaintiffs' privacy because they were not 
involved in intercepting the screenshots.^°' Even though Clements-Jeffrey might 
have been humiliated by their use of the screenshots during Clements-Jeffrey's ar- 
rest, it did not do anything additional to invade her privacy.^'" 

In sum, the court granted summary judgment on all claims against the police 
except for the Fourth Amendment claim relating to the warrantless search, about 
which the parties agreed that there were genuine issues of material fact.^" Howev- 
er, the court denied summary judgment and allowed all of Clements-Jeffrey and 
Smith's claims to go forward against Absolute, a promising result for future victims 
of remote webcam activation and surveillance.^'^ The case was ultimately settled. 

The Clements-Jeffrey case vividly illustrates the problems associated with the 
use of remote access tools by private companies to collect information for law en- 
forcement. Absolute touts its investigation team, made up of "45 individuals with 
1,000 years of combined experience in law enforcement." Many join Absolute 
"after a full career in law enforcement," while others have backgrounds with "the 
FBI, the Marines, the US Army, Homeland Security and government positions."^'^ 
Indeed, Absolute recruited Magnus, a longtime police officer, from his job with a 
sheriff's department.^"' The company states that its investigators "work closely with 
local police" to recover stolen devices.^''' According to a company datasheet, the 
company's investigators can: 

"Forensically mine a stolen or missing computer regardless of 
user or location 

Use key captures, registry and file scanning, geolocation, and oth- 
er investigative techniques to understand how and why a device 
was breached 

Determine who has the computer, what they're doing with it, and 
whether any data was accessed. . . ." 
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While the company's current website remains silent on the issue of webcam activa- 
tion, a 20I0 report stated that the company's investigators retained the ability to do 
so.^'^ 

The court in Susan Clements -Jeffrey's case may have been too quick to find that 
Absolute was not acting as an agent of the police, instead finding that Absolute's 
theft recovery officer, Kyle Magnus, had simply introduced himself to the police af- 
ter concluding his investigation and handed over the information he had gathered. ^'^ 
The evidence in the record on this point is ambiguous at best. Magnus testified that 
he did not recall sending screenshots to police officer Ashworth immediately after 
their first conversation, and Ashworth testified multiple times that he had "several 
conversations" and "many conversations" with Magnus in the course of the investi- 
gation."" Clements-Jeffrey testified in her deposition that Ashworth, after arresting 
her, told her, "We've had an officer in Milwaukee keeping you under surveillance 
over the last i6 days."^^' Contrary to the court's finding, the evidence suggests that 
Magnus and Absolute were effectively working on behalf of the Springfield police. 

If this was the case, Clements -Jeffrey and Smith might have successfully pur- 
sued § 1983 claims against Absolute based on a state action theory. The state action 
doctrine holds that constitutional protections only bind the government and not 
private parties, except when private parties act as agents of the government."^ Giv- 
en the high potential for abuse by companies like Absolute, legislation is needed to 
prohibit this invasive alliance between police and private investigation. Such legis- 
lation would prevent bedrock constitutional rights from being nullified by private 
companies performing de facto police work. 
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7. LEGAL CONCERNS IN REMOTE ACTIVATION 
OF WEBCAMS BY INDIVIDUALS 

ndividuals have found a variety of innovative uses for webcams, such as to mon- 
itor their property or to keep an eye on their loved ones. Often, their purposes 
are benign. Using webcams remotely has helped people achieve ends as diverse 
as live streaming events and detecting cases of elder abuse by nursing home staff. 
Hidden/^^ an anti-theft app for Apple products, provides remote webcam activation 
capabilities similar to those previously offered by LANrev and PC Rental Agent. 
Hidden assisted in a well-publicized recovery of a stolen laptop; after the police de- 
clined to investigate the theft, the laptop's owner started a Tumblr blog and created 
Twitter posts containing webcam photos taken using Hidden of the man in posses- 
sion of the laptop, who was soon identified. Other tools such as GoToMyPC"^ of- 
fer similar functionality"*' 

But by providing for the remote activation of webcams, apps like Hidden and 
GoToMyPC raise the same concerns about potential invasion of privacy as tools like 
LANrev and PC Rental Agent. Like some government entities and private compa- 
nies, individuals have sought to remotely activate others' webcams for questionable 
ends. Individuals are subject to the same hacking, wiretapping, and privacy laws as 
private companies and face the same criminal and civil liability for remotely acti- 
vating webcams to breach others' privacy. However, to a greater extent than with 
companies, individuals who spy on others through their webcams may be "judg- 
ment-proof" and have no assets to provide for recovery in a civil action. Moreover, 
it is often difficult to discover the identity of the spying individual, absent a slip-up 
or voluntary self-disclosure.^^'' 

Even common video chat applications allowing remote webcam activation pose 
serious risks. In September 2010, Dharun Ravi, a first-year student at Rutgers Uni- 
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versity, and a friend, Molly Wei, accessed Ravi's webcam through Apple's iChat 
application from Wei's room down the hall, and briefly viewed his roommate, Ty- 
ler Clementi, kissing a man in the room Clementi shared with Ravi.^^** Ravi posted 
about the incident on Twitter ("Roommate asked for the room till midnight. I went 
to molly's room and turned on my webcam. I saw him making out with a dude. Yay"), 
and Clementi saw his Tweet. Two days later, Clementi asked Ravi for private use 
of the room again for another romantic encounter and Ravi agreed. Later, Ravi pub- 
licized the encounter on Twitter in an apparent attempt to solicit viewers: "Anyone 
with iChat, I dare you to video chat me between the hours of 9:30 and 12. Yes, it's 
happening again."^^° Clementi saw the Tweet and turned off Ravi's computer prior 
to the encounter. The following evening, Clementi killed himself by jumping off the 
George Washington Bridge.^^' 

Prosecutors declined to charge Ravi in connection with Clementi's death; he 
could also not be charged with wiretapping or unauthorized access to a computer, 
as the computer and room he videotaped were his.^^^ Ravi was, however, charged 
and convicted of invasion of privacy as well as bias intimidation, tampering with 

a witness (by trying to influence what a witness 
told the police) and tampering with evidence (by 
deleting Tweets and posting a false Tweet).^^' Ravi 
was sentenced to 30 days in jail, three years of 
probation, 300 hours of community service and 
a $10,000 fine. 

The widespread use of webcams has also given 
rise to a disturbing practice known as "ratting," or 
installing a remote access Trojan^'^ on a victim's 
computer that can enable full control of the computer, including its webcam.^'*' Rat- 
ters obtain images or video from their "slaves" by surreptitiously activating their 
webcams or combing through the contents of their hard drives. They then use the 
images or video for entertainment or to extort money or additional images or video 
of a sexual nature. ^5'' 

While many ratters escape prosecution, law enforcement is increasingly paying 
attention to the phenomenon and has made some noteworthy arrests. ^5** Luis Mijan- 
gos was arrested after using remote access Trojans to infect 129 computers, netting 
hundreds of victims. The FBI "found different kinds of malware on [Mijangos'] 
computers [including] software to turn on webcams and microphones attached to 
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infected computers, and 'dozens of videos' from those webcams," most showing the 
victims getting out of the shower, dressing, or having sex.^^o Mijangos spread his 
malware by uploading it disguised as a popular song to a peer-to-peer file sharing 
network, and used it to take control of the computer of whomever downloaded the 
file. He would frequently reveal himself to a female victim as a hacker with control 
over her computer, telling her that he had seen an email she had just sent or heard a 
call she had just made, and demanding nude photos or video. If he gained control of 
a man's computer, he would send messages posing as the man to solicit nude photos 
from the man's girlfriend. 

Mijangos' victims were traumatized. One victim, an underage woman from 
whom Mijangos extorted nude photos, moved away from her home near Los Ange- 
les because of the incident; as she described the experience, "For the longest time I 
didn't know who this man was, why he was doing it or [if] he would come back. Not 
knowing is the worst, most dreaded feeling. It's always in the back of your mind. I 
moved away from the LA/OC [Los Angeles/Orange County] area but even here the 
thoughts never left me."^4i Mijangos ultimately pled guilty to felony wiretapping 
and computer hacking charges, and was sentenced to six years in prison. ^"^^ 

Prior to becoming Miss Teen USA 2013, Cassidy Wolf was the victim of another 
RAT-wielding "sextortionist."^"*^ Jared James Abrahams, a computer science student 
and former high school classmate of Wolf's, used a RAT to gain control of Wolf's 
computer and snap nude photos of her through her webcam, threatening to post 
them publicly unless she gave in to his demands. ^^^^ He took control of Wolfs com- 
puter and changed the passwords on her Twitter, Tumblr, and email accounts. He 
then emailed Wolf, attaching nude pictures taken with her webcam, and writing: 

Here's what's going to happen! Either you do one of the things listed 
below or I upload these pics and a lot more (I have a LOT more and 
those are better quality) on all your accounts for everybody to see and 
your dream of being a model will be transformed into a pornstar. Do 
one of the following and I will give you back all your accounts and de- 
lete the pictures. 

1) Send me good quality pics on Snapchat 

2) Make me a good quality video 

3) Go on skype with me and do what I tell you to do for 5 minutes 

If you don't do those or if you simply ignore this then those pics are 
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going up all over the internet. It's your choice :) Also I'm tracking this 
email so I'll know when you open it. If you don't respond then your 
pics are going up.^^s 



Instead, Wolf went to the FBI, which ultimately identified Abrahams as the culprit.^^e 
Abrahams later told the FBI that he had used a RAT to gain control over the laptops 
of up to 150 victims. Wolf used her fame as Miss Teen USA to become an advocate 
for cybercrime awareness. ^'•^ Abrahams pled guilty to federal computer hacking and 
extortion charges and was sentenced to 18 months in prison. 

Law enforcement authorities worldwide are turning increasing attention to the 
problem of ratters, as shown in May 2014, when raids in over a dozen countries led 
to the arrests of approximately 100 purchasers 

and users of Biackshades, a popular RAT that One fatter Spread his malware 

enabled spying through victims' computers.^so l^y disgUising it aS 3 popular 
Biackshades was created to be easy to use; ac- SODg OD 3 peer-tO-peer sharing 
cording to computer security journalist Brian netWOrk, taking COntrol Of 
Krebs,itwas "created and marketed principally ^-^g COmputer Of anyone who 
for buyers who wouldn't know how to hack their downloaded the SOng 
way out of a paper bag."^5i Biackshades sold for 

as little as $40 online, and could provide a ratter with full control over a victim's 
computer, including the ability to capture screenshots, log keystrokes, control ac- 
cess to files, and activate the webcam. Gaining access to, or "infecting," a victim's 
computer involved tricking the owner into clicking a malicious web link or opening 
a corrupted file.^53 According to the FBI, Biackshades was "used to infect more than 
half a million computers worldwide." Biackshades was ratter Jared James Abraha- 
ms' tool of choice in his snooping and attempted extortion of Cassidy Wolf.^^s While 
owning Biackshades is not in itself illegal, surreptitiously installing it on a victim's 
computer is considered computer hacking crime in many countries. 

In November 2014, law enforcement authorities in Europe arrested ratters in the 
United Kingdom, Estonia, France, Italy, Latvia, Norway and Romania. British cyber- 
crime investigator Peter Goodman stated, "The response on this occasion has been 
enforcement action ... to strike a blow against a particularly pernicious and invasive 
form of cyber-criminality" — ratters who can turn on victims' webcams and access 
banking or personal information. 

Ratters in the United States can be criminally charged under the federal Com- 
puter Fraud and Abuse Act for illegally accessing their victims' computers. Howev- 
er, their victims generally cannot sue them in civil court under the CFAA because 
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of the civil suit requirement of proof of monetary damages of over $5,000. In con- 
trast, certain states' computer trespass laws do allow civil suits by victims for unau- 
thorized computer access without a monetary harm requirement.^^s 
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ebcams present the opportunity for countless innovative uses by 
governments, businesses, and individuals. They have permanently 
changed the way we connect across distances with friends, family, 
and even employers, colleagues, and doctors. They entertain us 



and make us more productive. But policymakers have directed too little attention to 
how the ubiquity of webcams has infringed our privacy. Governments, businesses, 
and individuals have all taken advantage of the spread of webcams to surveil us in 
shocking ways. 

The ability to activate webcams remotely has garnered relatively little attention 
from lawmakers or policy analysts. Efforts to reform government surveillance have 
focused primarily on the bulk telephony metadata collection program under Sec- 
tion 215 of the PATRIOT Act program which does not involve hacking computers or 
targeting webcam transmissions. On the legislative front, U.S. Senators Ron Wyden, 
Mark Udall, and Martin Heinrich have called for an investigation into the National 
Security Agency (NSA)'s role in assisting with the U.K.'s Government Communica- 
tions Headquarters (GCHQ) with its global webcam chat surveillance program. Op- 
tic Nerve.^59 Independent advocacy groups including the Electronic Frontier Foun- 
dation (EFF) and American Civil Liberties Union (ACLU) have criticized the role of 
secret courts and gag orders in enabling electronic surveillance. 

In response to the Lower Merion case, the state of New Jersey passed the "Anti- 
Big Brother Act." That law requires school districts that provide students with devic- 
es including cameras or tracking technologies to notify them "that the electronic de- 
vice may record or collect information on the student's activity or the student's use 
of the device."^*'' The notice must also state that the district "shall not use any of the 
capabilities in a manner that would violate the privacy rights of the student or any 



[36] 



DIGITAL PEEPHOLES 



Policy Recommendations 



individual residing with the student."^^^ School districts are required to gather an 
acknowledgement of receipt of the notice from a parent or guardian on an accom- 
panying form and to retain the form for as long as the student has the device. ^''^ At 
the national level, late U.S. Senator Arlen Specter proposed the Surreptitious Video 
Surveillance Act of 2010, an amendment to the ECPA, to explicitly prohibit silent 
video interceptions without prior court approval, but the bill died in committee.^*''* 

We need stronger laws and regulations to protect our right to privacy as we move 

forward into the interconnected age. We recom- 
PolicymakerS have directed mend the following policy changes: 
too little attention to how The government should be prohibited 

the abuses of WebcamS have from using remote webcam activation in 
negatively impacted privacy. criminal investigations. The use of a webcam 

to invade someone's home to collect evidence is in 
direct contradiction of fundamental values under the U.S. Constitution. By target- 
ing a webcam rather than a particular user, remote activation is likely to invade the 
privacy of third parties. Video surveillance is uniquely intrusive under any circum- 
stances because a webcam is typically located in the home, where our notions of 
privacy are strongest.^''^ Allowing law enforcement to remotely activate webcams is 
akin to giving the government a pair of eyes in every home — something the Found- 
ers prohibited in the Third Amendment, which prohibits the quartering of soldiers 
without the owner's consent, except in a manner prescribed by law.^**" Additional- 
ly, webcam use by government investigators is an unreasonable search under the 
Fourth Amendment. 

The proposed changes to Rule 41(b) that significantly narrow the ter- 
ritoriality requirement should be rejected. While the government asserts 
a valid interest in being able to coordinate searches across jurisdictions in limited 
situations, such as to investigate a botnet, it should not be permitted largely to do 
away with the territoriality requirement altogether in cases of suspected computer 
crimes, as the proposed changes would. As reflected in the Third Circuit's recent 
reversal of a CFAA conviction on venue grounds, territoriality matters, even in the 
internet age.^^'' 

As for private businesses, the documented cases of remote webcam activation 
on record counsel strongly for laws banning their use of the technology outright. 
Private businesses should be prohibited from remotely activating users' 
webcams, because their doing so poses extraordinary threats to users' 
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privacy that the actual or perceived benefits do not come close to balanc- 
ing. As reflected in testimony in the Byrds' lawsuit over PC Rental Agent, remotely 
activating the webcam on a computer reported stolen is not required to locate the 
computer. Congress should pass legislation criminalizing the remote activation of 
another person's webcam/**^ and should forbid rental companies or other compa- 
nies from activating the computer webcam on users of their computers. A company 
like Absolute Software should not be permitted to offer customers a de facto private 
police force that exists for the purpose of performing highly invasive searches out- 
side the reach of constitutional protections. 

Additionally, greater efforts should be made to curb the abusive ac- 
tions of malicious individual ratters, even those who do not target a 
large number of victims or an unusually high-profile victim. Any ratter 
who accesses another's computer without authorization violates a number of priva- 
cy and computer crime laws, and any extortion or attempt to extort a victim using 
information gathered is an additional state and federal crime. The damage malicious 
ratters can do to their victims is extreme, in emotional and sometimes in monetary 
terms. Whether through increased training and resources to law enforcement in this 
area, or through the passage of laws specifically targeting the practice, additional 
measures should be taken to ensure that malicious ratters cannot continue to inflict 
emotional distress and to extort their victims with impunity. More states should 
pass laws allowing civil suits by victims for unauthorized access to their computers 
without any requirements of proof of monetary damages. Law enforcement and 
the judicial system should step up their efforts to prevent, investigate, and punish 
anyone who criminally invades computer users' privacy. 
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